AND-801
Android Application Development v8
AND-801 Exam Guide: Android Enterprise and Intune Preparation Strategy
The available official evidence does not publish a verified AND-801 blueprint, question count, passing score, duration, language list, delivery method, or scheduling rules. It does, however, point to a practical subject area for preparation: administering Android Enterprise devices with Microsoft Intune, including enrollment choices, app deployment, work profiles, conditional access, and troubleshooting. This guide helps candidates decide whether that evidence matches their AND-801 listing, build a focused lab-based study plan, and avoid treating general Android support knowledge as proof of exam readiness.
What can be verified about AND-801 before you schedule it?
Verify the exam’s official provider page and current objective list before paying for or booking the assessment. The supplied research identifies Android Enterprise administration topics in Microsoft Intune, but it does not identify an official AND-801 title, sponsoring organization, eligibility rule, score, format, or availability status.
That distinction matters. The material supplied for this guide is strong enough to support a preparation plan around Android Enterprise management, but not strong enough to state that every topic below is tested by AND-801. Treat the Microsoft documentation as a subject-matter reference and the exam provider’s listing as the authority for the assessment itself.
A sensible decision rule is simple: proceed with this guide if your official AND-801 objectives mention Android Enterprise, Intune, enrollment, managed Google Play, work profiles, corporate-owned devices, application deployment, or conditional access. If the listing points to a different Android product or certification family, stop and rebuild the plan around that provider’s blueprint instead.
What the supplied sources do not establish
No supplied source gives an AND-801 domain breakdown or blueprint weights. Do not assign percentages to enrollment, security, applications, or troubleshooting, and do not use a practice site’s claimed weighting unless the official exam owner publishes it.
No supplied source confirms the number of questions, exam duration, passing score, retake policy, registration fee, testing locations, remote-proctoring rules, language options, prerequisites, or retirement status. Those details can change and must be checked on the official scheduling page immediately before registration.
Who should use this preparation path?
This path suits candidates who design, enroll, secure, configure, or troubleshoot Android Enterprise devices in a Microsoft Intune environment. It is especially relevant to administrators who must choose between BYOD work profiles and corporate-owned management modes, connect Managed Google Play, deploy applications, and reason about policy behavior.
It is less suitable as a stand-alone plan for a developer certification, an Android application-development exam, or a general mobile-support assessment. The supplied evidence concentrates on enterprise administration rather than Java or Kotlin coding, UI construction, application architecture, or consumer Android usage.
Use your work history to choose the starting point. An Intune administrator may need to strengthen Android enrollment and platform-specific behavior. A mobility specialist may need to learn the Intune navigation and policy dependencies. A support professional may need more practice distinguishing an enrollment problem from an authentication, certificate, application, or conditional-access problem.
Choose a track based on your current experience
Start with configuration and decision analysis if you already manage Microsoft Intune but have limited Android Enterprise exposure. Start with Intune fundamentals if you understand Android management but rarely configure tenant-side enrollment, application, or compliance policies.
Start with troubleshooting if you can build a basic lab but lose time when several layers fail at once. Your goal is not to memorize isolated fixes. It is to identify the failing boundary, collect the relevant evidence, test one variable, and document the result.
Which technical abilities should your study plan develop?
Build five connected abilities: selecting an enrollment model, configuring the supporting services, deploying and controlling applications, applying access and security policy, and diagnosing failures. The official Intune guide describes onboarding to Google, application deployment, work profile enrollment, conditional access, the end-user experience, and work profile passcode reset as common scenarios.
These are better study targets than a product-menu checklist because an enterprise scenario normally links several decisions. For example, the correct device model affects whether a user account is associated with the device, which in turn affects the suitability of user-centric applications and the controls an administrator can apply.
Study every topic by answering three questions: What business requirement does this control address? Which enrollment model supports it? What evidence would show that it worked or failed? This method turns documentation into operational judgment rather than passive recall.
Enrollment-model judgment
Know the difference between a personal BYOD device using a work profile, a dedicated corporate-owned device used in kiosk-like scenarios, and a fully managed corporate-owned device associated with one user. The supplied Intune guidance presents these as distinct use cases rather than interchangeable labels.
For BYOD, learn the separation between the managed work space and the user’s personal profile. The source states that Android Enterprise work profiles are built into Android 5.1 and later versions and that work apps and data are kept in a separate, self-contained company-managed space while personal apps and data remain in the personal profile.
For dedicated devices, focus on shared or task-specific use. The source describes these devices as commonly locked to one app or a set of apps and notes that they are enrolled without a user account and are not intended for personal-use applications or applications with a strong requirement for user-specific account data.
For fully managed devices, focus on the single-user corporate-owned scenario. The source contrasts this with a work-profile scenario in which multiple users have control, while the administrator retains full control of a fully managed device.
Feature and policy reasoning
Do not study enrollment modes as names only. The official comparison shows that feature availability differs among work profile, dedicated, and fully managed methods. Examples in the supplied table include managed email profiles, managed Wi-Fi profiles, managed VPN profiles, certificate profiles, factory-reset controls, camera and screen-capture restrictions, volume-button restrictions, data-sharing controls, passwords, and managed applications.
The practical lesson is to validate the chosen management mode against the required control before enrollment. A design that meets the ownership requirement but lacks a required policy is not complete. Record both the desired control and the enrollment method that supports it.
The source explicitly warns that not all features are available for both methods. Your notes should therefore contain a small requirement-to-management-model matrix, with a source link beside each conclusion. This is more reliable than assuming that a setting available for one Android Enterprise mode appears in all modes.
Google connection and application deployment
Learn the administrative sequence for connecting Managed Google Play and approving or deploying applications, but confirm the current interface in the live Microsoft Learn article. The supplied guidance directs an administrator to Devices, Android, Android Enrollment, and Managed Google Play, then to accept the agreement and launch Google to connect the services.
The same guide identifies Managed Google Play app as an available Store app type. Use that fact to understand the deployment workflow: connect the service, select an appropriate application source or type, configure assignment and policy, then verify installation on the enrolled device.
Your lab notes should separate service connection, application selection, assignment, installation, update behavior, and user access. When an app does not appear, do not jump immediately to device troubleshooting; first check whether the service connection, approval, assignment, platform support, and enrollment context are correct.
Conditional access and authentication troubleshooting
Study conditional access as a dependency chain rather than a single switch. A device may be enrolled yet fail an access requirement because of identity, compliance, certificate, network authentication, or application conditions. The supplied Intune guide includes conditional access among its common Android Enterprise scenarios, while the Microsoft Q&A example shows how Android Wi-Fi authentication can introduce an anonymous identity or outer-identity issue.
In the Q&A scenario, the user reports NPS-based RADIUS authentication problems when Android asks for an anonymous identity. The answer points to enabling identity privacy and specifying an anonymous identity name, or leaving the field blank, while linking to older Microsoft documentation. Treat this as a troubleshooting example, not as a universal configuration prescription for every Android Wi-Fi deployment.
When studying an authentication failure, map the path: device enrollment, network profile, certificate or credential, RADIUS or NPS behavior, outer authentication identity, inner authentication, and access policy. Change one layer at a time and record the exact result.
End-user experience and support boundaries
An administrator must understand what the user sees and what the organization can control. The Intune guide includes the work-profile enrollment experience and work-profile passcode reset, while its troubleshooting material distinguishes work-profile controls from corporate-owned reset behavior.
One documented limitation is especially useful for scenario reasoning: the supplied source says that, for a work-profile-enrolled device, the Wipe or Factory Reset option is not available and the only option is Retire, which removes the whole work profile and its contents. Do not generalize this behavior to every Android Enterprise enrollment mode.
The same source states that a work-profile passcode can be reset only on devices running Android 8.0+ when the work-profile passcode is managed and the user has allowed the administrator to reset it. Keep the Android version, management condition, and user-consent condition together in your notes; separating them creates an incomplete answer.
How should you build a lab without overclaiming exam coverage?
Use a lab to test the documented workflows, not to recreate confidential exam content. A useful lab contains a tenant or authorized test environment, an Android device or supported emulator where appropriate, a test identity, a deliberately small policy set, and a method for recording enrollment, application, compliance, and access results.
The objective is repeatable explanation. After each exercise, write what you configured, why you selected the enrollment model, what the user experienced, what evidence confirmed success, and what would change for another model. This exposes gaps that reading alone can hide.
Do not infer that a feature is examinable merely because it appears in a lab. Match each exercise to an official AND-801 objective when that objective is available; otherwise label the exercise as domain preparation based on Microsoft’s Android Enterprise guidance.
Lab exercise 1: compare the three management scenarios
Create a decision sheet for BYOD work profile, dedicated device, and fully managed device. For each, record ownership, whether a user account is associated, whether the device is intended for personal use, the expected application pattern, and the administrator’s required controls.
Then validate the differences against the official comparison. Include at least one requirement that would favor a work profile, one that would favor a dedicated device, and one that would favor fully managed administration. The point is to explain trade-offs, not to declare one method universally best.
Lab exercise 2: connect Managed Google Play and deploy an app
Follow the documented connection path in a test environment, then deploy a permitted application using the Managed Google Play app type described by Microsoft. Record each administrative dependency and verify the result on the target enrollment model.
Repeat the exercise with an intentionally incorrect assignment or unsuitable device context if your environment allows it. Document the symptom and the first administrative check. This creates a troubleshooting decision tree without relying on leaked questions or memorized answer sets.
Lab exercise 3: test work-profile controls
Enroll an authorized test device as a work-profile device and verify that work applications and data are managed separately from personal applications and data. Test the documented passcode-reset prerequisites only where your organization permits it.
Record the difference between removing the work profile and resetting the entire device. The supplied source’s distinction between Retire and Factory Reset is a strong example of why ownership and enrollment context must be part of every troubleshooting note.
Lab exercise 4: trace a network-authentication failure
Use a controlled Wi-Fi and RADIUS or NPS test environment if you have one. Begin with the network profile, then inspect certificate or credential configuration and the Android authentication fields. Include the anonymous identity or outer-identity question raised in the Microsoft Q&A case.
Do not copy a setting blindly from a forum answer. Verify what identity privacy is intended to protect, identify which authentication phase is failing, and confirm the configuration against the network team’s EAP and NPS design.
What study sequence gives the best return?
Study in dependency order: first the enrollment models, then service onboarding and applications, then profiles and restrictions, then conditional access and authentication, and finally troubleshooting. This order prevents a common mistake—trying to diagnose a policy symptom without understanding how the device was enrolled or which management capabilities it supports.
Use short retrieval sessions after each lab. Close the documentation and explain the scenario from memory, then reopen the source to correct omissions. Your notes should emphasize conditions, exclusions, and consequences because those are the details most likely to distinguish a sound administrative decision from a plausible but unsafe one.
Stage one: establish the management model
Begin by drawing the three enrollment scenarios from memory. Add the business purpose, user association, personal-use expectation, and primary administrator controls for each. Check your drawing against the Microsoft Learn guidance and correct it in a different color.
Next, build a feature matrix from the official table. Keep the domain labels descriptive—work profile, dedicated kiosk, and fully managed—rather than reducing the exercise to a list of unsupported yes-or-no assumptions. Mark every capability that you have not personally validated as documentation-dependent.
Stage two: learn the provisioning chain
Study Google onboarding, Managed Google Play, enrollment, application assignment, and user experience as one chain. For every step, identify the prerequisite before it and the observable result after it.
Practice explaining why a missing application might result from an unconnected service, an unapproved app, an incorrect assignment, an incompatible enrollment context, or a device-side installation problem. This sequence is more useful than memorizing a single menu path that may change.
Stage three: add access and security policy
Once the device and app lifecycle is clear, add Wi-Fi, VPN, certificates, passwords, data sharing, camera, screen capture, and conditional access to your notes. The supplied comparison shows that these controls do not have identical availability across management methods.
For each control, write a scenario, a supported enrollment context if documented, and a verification method. If the source does not establish a particular dependency, say so rather than filling the gap with a guess.
Stage four: troubleshoot by isolation
Create fault cards with four fields: symptom, likely boundary, evidence to collect, and next test. Examples include an app absent from Managed Google Play deployment, a work-profile passcode reset that is unavailable, a device that cannot use a requested reset action, and Android Wi-Fi authentication that fails around anonymous identity.
Review the cards by covering the diagnosis and reconstructing it from the symptom. The aim is to produce a defensible next action, not to produce a confident list of every possible cause.
Which mistakes waste preparation time?
The biggest preparation mistake is treating unsupported exam details as facts. A second is studying Android Enterprise labels without comparing their purpose and feature boundaries. A third is memorizing troubleshooting commands without identifying the enrollment model, identity context, and policy dependency behind the symptom.
Avoid these errors by keeping an evidence register. For every note, mark it as an official AND-801 requirement, an official Microsoft product behavior, a lab observation, or a practical recommendation. Only the first category should be treated as confirmed exam scope.
Mistake: inventing a blueprint from topic prominence
The supplied research contains detailed Android Enterprise material but no AND-801 percentages. Topic detail in a reference article is not evidence of exam weighting. Do not write a study schedule that assigns more time because a source page contains more paragraphs.
Use your own diagnostic results to allocate time until the official blueprint is available. Spend more time on tasks you cannot perform or explain, while maintaining light review of areas you already handle confidently.
Mistake: confusing corporate ownership with fully managed mode
Corporate-owned does not automatically mean one specific management mode. The Intune guidance distinguishes dedicated devices from fully managed devices and assigns them different use cases. Dedicated devices are typically locked to a single app or set of apps and are enrolled without an end-user account; fully managed devices are presented as a more user-centric, single-user scenario.
When a scenario mentions kiosk behavior, shared use, or no end-user association, test the dedicated-device reasoning. When it mentions one user with full administrative control and user-centric applications, test the fully managed reasoning.
Mistake: applying a work-profile action to the whole device
A work profile separates company-managed data from personal data, so lifecycle actions cannot be assumed to equal a factory reset. The supplied guidance specifically identifies Retire as the available option in the documented work-profile situation and says it removes the work profile and its contents.
Put ownership and enrollment type at the top of every incident record. That one habit prevents a large class of destructive or unavailable-action mistakes.
Mistake: treating a community answer as a complete design
The Microsoft Q&A page is useful evidence of a real RADIUS and Android authentication problem, but it is not an AND-801 blueprint and does not replace current product documentation. Its answer also links to a previous-version Microsoft page.
Use community material to form questions and hypotheses. Confirm the final configuration with the current official documentation and the organization’s authentication design before treating it as operational guidance.
Mistake: relying on stale Windows Android-app material
The supplied Windows support page concerns Windows Subsystem for Android and mobile apps on Windows, not Android Enterprise device enrollment in Intune. It states that Windows Subsystem for Android and the Amazon Appstore were no longer available in the Microsoft Store starting March 5, 2025.
That page may help only if your official AND-801 objectives explicitly include Android apps on Windows. Do not let Windows Subsystem for Android troubleshooting displace Android Enterprise enrollment, policy, application, and access preparation unless the exam listing requires it.
How should you use the official sources?
Use Microsoft Learn as the main technical reference for Android Enterprise administration because the supplied research describes enrollment scenarios, Google onboarding, application deployment, conditional access, work-profile experience, and passcode reset in one operational guide. Use the Microsoft Q&A example for authentication terminology and use the Windows and OneNote pages only when your verified exam objectives include those subjects.
Read the source pages actively. Extract prerequisites, exclusions, ownership assumptions, version conditions, and administrator paths. Then convert each extraction into a scenario question that asks for the best next decision rather than a phrase copied from the page.
Recommended reading order
Read the Android Enterprise Intune guide first: https://learn.microsoft.com/en-us/troubleshoot/mem/intune/device-enrollment/configure-android-enterprise-devices-intune. Start with the evaluation of needs and enrollment-model comparison, then move through Google onboarding, application deployment, conditional access, user experience, passcode reset, and the FAQ.
Read the Android RADIUS and anonymous-identity Q&A second: https://learn.microsoft.com/en-us/answers/questions/2239103/android-radius-anonymous-outer-identity-problems-w. Use it to distinguish an outer identity from the real user identity and to practice identifying what still needs validation.
Use the Microsoft Intune Android Enterprise article for broader context only after the core workflow is understood: https://techcommunity.microsoft.com/blog/microsoftintuneblog/how-does-microsoft-intune-transform-android-enterprise-management-let-me-count-t/299289. The supplied extract does not provide enough readable evidence to use it for exact exam requirements.
Use the dedicated-device and shared-device article only if the verified AND-801 objectives include that scenario: https://techcommunity.microsoft.com/blog/intunecustomersuccess/enroll-android-enterprise-dedicated-devices-into-azure-ad-shared-device-mode. Do not infer details that are not visible in the supplied research.
Use the OneNote for Android page only for an explicitly verified OneNote-on-Android objective: https://support.microsoft.com/en-us/onenote/microsoft-onenote-for-android. The page lists topics such as notebooks, synchronization, notes, Sticky Notes, screen-reader support, and troubleshooting, but the supplied evidence does not connect those topics to AND-801.
Use the Windows mobile-app troubleshooting page only for an explicitly verified Windows Subsystem for Android objective: https://support.microsoft.com/en-US/Windows/Apps/MobileApps/troubleshooting-and-faq-for-mobile-apps-on-windows. It is a separate support context from Android Enterprise management in Intune.
What should the final review week look like?
In the final review period, stop expanding the syllabus and test decision quality. Recreate the enrollment comparison without notes, complete one end-to-end application workflow, explain the work-profile lifecycle, and troubleshoot one authentication scenario from symptom to evidence request. Then check the current official AND-801 listing for any objectives or delivery rules that were not available in the supplied research.
Do not book based on confidence from repeated recall alone. Book when you can explain why an enrollment model fits a requirement, identify a feature limitation, state what evidence you need for a failure, and separate verified requirements from assumptions.
A practical readiness check
You are technically better prepared when you can answer these questions without opening the documentation: Which management model fits BYOD? Which model fits a kiosk? Which model fits one user on a corporate-owned device? What changes when a feature is unavailable in a selected mode? How does Managed Google Play fit into application deployment?
You should also be able to explain why a work-profile action is not automatically a factory reset, what conditions apply to a documented work-profile passcode reset, and how anonymous identity relates to the outer authentication phase in the RADIUS example.
These are not claims about the exact AND-801 questions. They are readiness checks derived from the supplied technical evidence and should be supplemented with the official exam objectives.
A last source and scheduling check
Before scheduling, confirm the official exam title, provider, objective domains, prerequisites, delivery method, available languages, question and time information, score policy, retake rules, price, and appointment conditions directly with the exam owner. None of those AND-801 details is verified in the supplied research.
Check the source pages again for changes, especially where the documentation is marked as updated or where a community answer links to previous-version material. Record the date of your verification in your own study log, but do not treat that log date as an exam date or status claim.
What should you do next?
First, locate the official AND-801 listing and compare its objectives with the Android Enterprise and Intune subjects in this guide. Second, build the enrollment-model matrix and work through the Microsoft Learn guide. Third, run a controlled lab or tabletop exercise for onboarding, application deployment, policy selection, and troubleshooting. Finally, return to the official provider page to make the scheduling decision with current information.
If the official blueprint confirms this subject area, use the guide as a practical framework and fill any objective gaps from current official sources. If it does not, do not force the match: retain only the transferable study habits—evidence tracking, dependency mapping, lab verification, and scenario-based review—and follow the correct AND-801 documentation instead.
Conclusion
The supplied evidence supports a disciplined Android Enterprise administration study path, not a complete verified AND-801 specification. Prepare around enrollment-model selection, Intune onboarding, Managed Google Play, application and policy behavior, conditional access, work-profile boundaries, and evidence-led troubleshooting. Confirm every exam-specific requirement with the official provider before scheduling, and label practical recommendations separately from documented Microsoft behavior.
Related exams
- AND-802 exam — Android Security Essentials
- AND-803 exam — Android Applications UI/UX Design and Monetization Techniques